Psoenen's Blog

One of the many challenging risk management issues faced by organisations today is protecting the privacy of customers’ and employees’ personal information. When privacy is well managed, organisations earn the trust of their customers, employees, and other stakeholders. When it’s poorly managed, trust and confidence can quickly erode. And today, boards and audit committees want assurance around the organisation’s processes that protect private information.

Many countries have adopted nationwide privacy legislation governing the use of personal information, as well as the export of this information across borders. For businesses to operate effectively in this environment, they need to understand and comply with these privacy laws. Recent incidents of identity theft, mismanagement of personal information, and violation of privacy principles have increased regulatory and consumer pressure on organisations to develop appropriate controls in relation to privacy, data management, and information security.

The American Institute of Certified Public Accountants (AICPA) defines privacy as “the rights and obligations of individuals and organisations with respect to the collection, use, disclosure, and retention of personal information”.

The European Data Directive 95/46/EC requests that “Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.” .

In today’s business context, privacy often refers to the privacy of personal information about an individual and the individual’s ability to:

• Know how his or her personal information is handled;
• Control the information collected;
• Control what the information is used for;
• Control who has access to the information;
• Amend, change, and delete the information.

Personal information is data that can be linked to or used to identify an individual either directly or indirectly. Examples of personal information are:

• Person’s name;
• Home address;
• Pictures;
• Telephone numbers (even a professional telephone number);
• Identifiers such as Social Security, social insurance, passport, or account numbers;
• Bank account numbers;
• e-mail addresses;
• Fingerprints;
• Physical characteristics;
• Credit records;
• Consumer purchase history;
• Employee files.

Sensitive personal information requires an extra level of protection and a higher duty of care:

• Medical records;
• Financial information;
• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Information related to offenses or criminal.

Anonymised information about people cannot be associated with specific individuals. This includes statistical or summarised personal information for which the identity of the individual is unknown or linkage to the individual has been removed.

Good privacy governance involves identifying significant risks to the organisation, such as a potential misuse, leak, or loss of personal information. It also implies ensuring appropriate controls are in place to mitigate the privacy risks.

For businesses, the benefits of good privacy controls include:

• Protecting the organisation’s public image and brand;
• Protecting valuable data on the organisation’s customers and employees;
• Complying with applicable privacy laws and regulations;
• Enhancing credibility and promoting confidence.

For public-sector and non-profit organisations, the additional benefits of good privacy controls include:

• Maintaining trust with citizens and noncitizens;
• Sustaining relationships with donors of non-profit organisations by respecting the privacy of their activities.

The Privacy Challenge

Normally organisations recognise the need for implementing good privacy practices. However, the challenge is sustaining the privacy program. With the proliferation of data management technology, organisations have difficulty identifying where this data is stored, how it is protected, who has access to it, and how it is securely disposed. In addition, accountability and responsibility for maintaining the privacy practices is not always clearly assigned within the organisation.

Privacy regulations

Multiple regulations have been developed by various countries and organisations. 

The Commission for the Protection of Privacy (CPP)

The Commission for the Protection of Privacy (CPP), known as Belgian Privacy Commission, is an independent authority ensuring the protection of privacy during the processing of personal data. The Commission recognises the information society’s need to collect and process personal data for societal and economic developments and compares societal and economic needs with this fundamental right in order to come to decisions and privacy safeguards reconciling both elements. The Commission realises that any personal data processing operation implies risks for privacy protection. It consequently stresses the importance of informing data subjects as well as processors about these risks, and of integrating safeguards, particularly relating to information security. Moreover, it focuses on the importance of the use of technologies in personal data processing for more well-being and welfare for citizens in our current society.

Processing of privacy data

Personal data

A data processing operation starts with the collection of data. Before the data is collected, however, the controller has to notify the processing to the Commission. The data has to be collected fairly and therefore transparently. The controller collecting personal data has to inform the person about the processing. The controller has to:

• clarify why he wishes to obtain your personal data;
• transmit his contact details to you;
• let you know who your data will be disclosed to;
• inform you about your right to access and rectify your data;
• mention that you may object free of charge to the use of your data for direct marketing, e.g. commercial actions.

Sensitive data

Some data are so delicate that they may only be processed in specific cases. Sensitive data covers race, health, political opinions, philosophical beliefs (religious or atheist, etc.), sexual preferences or judicial past. The Privacy Law most strictly regulates registration and use of those data.

The controller may process sensitive data relating to you (except for judicial data) if:

• he has the person’s consent in writing;
• if it is needed to provide the person with a necessary treatment;
• it is compulsory under employment law.

Controller’s data commitments

The controller has to ensure:

• the good quality of the data, in other words the data has to be precise;
• the confidentiality of the data. He must ensure that not just anybody can access and disclose the data;
• the security of the data. He must ensure that the data is not lost or stolen. The more sensitive the data, the higher the level of security has to be;
• that he does not keep the data any longer than necessary to achieve his purpose. At the end of the processing operation, he therefore has to delete the data.

Privacy control framework

Basic privacy control framework activities include setting objectives, establishing policies and procedures, and establishing monitoring and improvement mechanisms. Many organisations use control frameworks such as COSO (The Committee of Sponsoring Organisations of the Treadway Commission’s 1992 Internal Control — Integrated Framework) or its 2004 ERM (Enterprise Risk Management — Integrated Framework) enhancement.

Qualified Audit Partners’ governance risk management framework can be applied to privacy management and control:

Data privacy implementation

The implementation of a data privacy approach in the organisation is based on several steps:

1. Data has to be inventoried and classified according its sensitivity;
2. The information security attributes should be applied;
3. Privacy practices have to be implemented within the organisation.

Data inventory and classification

The organisation’s private data is one of the most vital corporate assets A corporate classification program for privacy-protected data will assist in prioritising the data. Assigning a sensitivity level, such as secret, confidential, proprietary or public, to data assists in evaluating the appropriateness of the controls over the technology and business processes that handle it.

Information security

The CPP commission requires information security to be checked against seven security attributes:

• Confidentiality: only persons having authorisation can access the information;
• Integrity: the information cannot be altered intentionally or unintentionally;
• Availability: the information is accessible and usable whenever an authorised person has requested it;
• Accountability: there is always a trace of the author and of how the information was edited;
• Non-repudiation: proof that an operation or event actually took place, meaning that it cannot be denied now or at a later time;
• Authenticity: it is certain that a person really is who he claims to be;
• Reliability: the characteristic of achieving the expected result.

Implementation of privacy practices

To implement and manage an effective privacy program, the organisation should clearly define its privacy policies, communicate those policies, and document the procedures and controls relating to the collection, use, retention, and disclosure of personal information to ensure compliance with laws, regulations, and the organisation’s policies. Specific criteria that are relevant, objective, complete, and measurable should be established for evaluating each of the effectiveness of these practices.

The Commission for the Protection of Privacy (CPP) proposed the introduction of 10 security measures:

Cross-Border Transfers of Personal Data

Personal data can move freely within the European Union, as long as the European Data Privacy Directive (95/46/EC) is observed. Indeed, all Member States apply the same level of protection when processing personal data.

Outside the European Union, only transfers to countries ensuring a level of protection equal to that which is offered on EU territory are authorised. The European Commission has recognised an adequate level of protection for the following countries: Switzerland, Canada, Argentina, the United States (if the recipient has accepted the “Safe Harbor Principles”), Guernesey and the Isle of Man.

If the country of final destination of the data is not included in the European Commission’s list, the controller may ensure adequate protection through a contract. This contract is binding for the individual transferring the data and for the one receiving it, and that contains sufficient safeguards with respect to data protection. In Belgium such a contract has to be authorised by Royal Decree, following the opinion of the Commission for the Protection of Privacy. To help the controller in this process, the European Commission has drawn up standard contractual clauses, which are automatically considered as sufficient safeguards for data protection.

Patrick Soenen | p.soenen[at]qap.eu ♦ Jean-Pierre Palante | jp.palante[at]qap.eu